Nexus Repository 3 CVE-2026-77121

The attacker must hold an authenticated Nexus Repository 3 account with deploy permissions on at least one hosted Maven repository - a credential level typically granted to CI/CD service accounts, developers, or build automation tokens. Only hosted Maven repositories are referenced as the target surface; proxy or group repository types are not described as affected. No non-default platform configuration is required beyond the standard hosted Maven repository setup. Anonymous or read-only users cannot trigger the flaw. The impact boundary is strict: only the single targeted repository becomes unavailable, leaving the Nexus server and all other repositories fully operational.

Real-world risk is moderate and narrowly scoped. The CVSS 4.0 score of 5.3 with vector PR:L/VA:L accurately captures the limited blast radius: only the targeted hosted Maven repository is disrupted, not the server or other repositories, and the condition is administratively reversible. The attack requires valid deploy credentials, which meaningfully raises the bar above unauthenticated exploitation. No EPSS data, KEV listing, or public exploit code was provided or identified; exploitation probability and active-exploitation status are unconfirmed. For organizations with large numbers of users or service accounts holding deploy permissions - common in open-source mirrors, self-service CI platforms, or shared build environments - the risk is elevated because a compromised CI token or malicious insider could deliberately target a critical dependency repository. However, the recoverable nature of the DoS and the scoped impact limit this to an operational rather than a catastrophic risk. Patching to 3.95.0 is the clear priority.

An attacker with a valid Nexus deploy token - obtained via a compromised CI/CD pipeline credential, a misconfigured service account, or a malicious insider - uploads a specially crafted Maven POM file containing an artificially oversized metadata field to a targeted hosted repository. Once the repository ingests the file, all subsequent browse and component-listing operations against that repository return errors, blocking developers and pipelines from resolving dependencies. The disruption persists until a Nexus administrator manually identifies and repairs the corrupt metadata record.